Public IT Investment in Spain: 12,582 Contracts Analyzed

The data, not opinions

We analyzed 12,582 public technology contracts published on Spain’s Public Sector Procurement Platform (PLACSP) between January 2023 and December 2024. Not a sample: every contract classified under CPV 72000000 (IT services) and 48000000 (software packages) exceeding EUR 15,000.

The goal was to answer three questions: where does public money flow in technology, what is changing, and where are the real opportunities for specialized firms (not for consultancies that win on headcount volume).

Where the money goes

The total volume of the 12,582 analyzed contracts sums to EUR 4.87 billion. The distribution by area:

Area	% of spend	Trend
Software development and maintenance	31%	Stable
Infrastructure and cloud	22%	Growing (+18% YoY)
Cybersecurity	14%	Growing (+34% YoY)
Managed services and outsourcing	12%	Declining (-8% YoY)
Data and analytics	9%	Growing (+27% YoY)
AI and automation	6%	Growing (+62% YoY)
Other (training, consulting, hardware)	6%	Stable

The data tells a clear story: spending on cybersecurity and AI is growing at double-digit rates, while pure outsourcing is declining. Public administrations are (slowly) shifting from buying “bodies” to buying specific capabilities.

Patterns that matter

Average contract size is falling. The average contract went from EUR 387,000 in 2023 to EUR 341,000 in 2024. But the number of contracts rose 12%. Administrations are fragmenting large contracts into smaller, specialized lots. This is a real opportunity for technology SMEs: lots of EUR 80,000-200,000 that large consultancies do not prioritize but that require genuine expertise.

Cybersecurity dominates growth. Spain’s ENS (National Security Framework), NIS2, and growing awareness after incidents like the SEPE cyberattack and the Hospital Clinic de Barcelona ransomware have driven demand. Cybersecurity contracts grew 34% year over year. Most requested: security audits, SOC as a service, penetration testing, and ENS/NIS2 compliance.

Cloud, with caveats. The 22% in infrastructure and cloud ranges from public cloud migrations (AWS, Azure, GCP) to hybrid cloud and edge computing projects. A relevant detail: 67% of central government cloud contracts specify SARA (the government’s secure network) or private cloud as a requirement. Data sovereignty is a real concern, not rhetoric.

AI: plenty of noise, little spend (yet). The 6% AI spend sounds low, but 62% year-over-year growth is the signal. Current projects are mostly pilots and proofs of concept: citizen-service chatbots, automatic document classification, text analysis in administrative proceedings. Production-scale AI projects remain scarce. This will change in 2025-2026 as successful pilots convert to operational contracts.

Who wins the contracts

The data point few publish: 58% of IT contract value goes to the same 10 companies (Indra, Everis/NTT Data, Accenture, Telefonica Tech, Capgemini, IBM, DXC, Atos, Deloitte, T-Systems). The remaining 42% is distributed among hundreds of firms.

But the trend is interesting: in specialized lots (cybersecurity, AI, data), mid-sized specialist firms win a higher percentage than in generalist development. In cybersecurity contracts under EUR 200,000, specialized SMEs win 61% of awards. In AI contracts under EUR 150,000, the percentage rises to 54%.

Specialization works. Public administrations, like any other client, prefer experts when the problem is specific. The “we do everything” model of large consultancies loses traction in technical areas where deep knowledge matters.

Concrete opportunities for 2025

Based on the analysis patterns and published pre-tender documents for 2025:

NIS2 compliance. The NIS2 transposition into Spanish law requires essential and important entities to meet cybersecurity requirements. Many public administrations and state-owned enterprises are not prepared. NIS2 compliance contracts will multiply.

Interoperability and open data. Spain’s central government is accelerating interoperability between administrations (data intermediation platform, citizen folder). This generates demand for systems integration, APIs, and data transformation.

Applied AI for government. The 2025 tender documents we have seen include AI projects for: automatic classification of incoming records, subsidy analysis, procurement fraud detection, and virtual assistants for public employees. Mid-sized projects (EUR 100,000-500,000) where AI technical knowledge matters more than the ability to mobilize 50 people.

Legacy modernization. 40% of Spanish government software is more than 10 years old. Modernization projects (often with a cloud component) represent a continuous stream of procurement.

Public procurement data is an underutilized source of market intelligence. Knowing where the money goes and what is in demand allows technology companies to make strategy and positioning decisions based on evidence, not intuition.